I do what Colin does, and it has worked pretty well. Most of the functional areas have essentially the same base access, with managers getting a bit more, so it's not much to just copy a user and modify them. I've also used the Change Prg Name (very handy) to make global modifications, like changing T6INA, T6INB to T7INA, T7INB, and then quickly back to T6INA, T6INB....
I'd recommend that approach.
Val